20360 matches found
CVE-2025-3812 WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcldopenaideletetrainingfile function in all versions up to, and including, 13.6.2. This makes it possible for authenticated attackers, with Subscriber-lev...
WordPress plugin EventON Pro 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2025-21787 · WordPress · Eventon Pro
Name of the Vulnerable Software and Affected Versions: EventON Pro plugin for WordPress versions up to, and including, 4.9.6 Description: The issue is related to a missing capability check in the 'assets/lib/settings/settings.js' file, allowing authenticated attackers with Subscriber-level access...
WordPress plugin WPBot Pro Wordpress Chatbot 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2025-21775 · WordPress · Wpbot Pro
Name of the Vulnerable Software and Affected Versions: WPBot Pro Wordpress Chatbot plugin versions up to, and including, 13.6.2 Description: The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcld openai...
WordPress WPBot Pro Wordpress Chatbot plugin <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability
Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WPBot Pro Wordpress Chatbot versions = 13.6.2...
CVE-2025-46464
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.This issue affects Ads Pro: from n/a through = 5.0...
CVE-2025-32296
Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through 14.8.1...
CVE-2025-32295
Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through = 10.10.2...
CVE-2025-32301
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup CountDown Pro WP Plugin circularcountdown allows SQL Injection.This issue affects CountDown Pro WP Plugin: from n/a through = 2.7...
Pro-Ukraine Group Targets Russian Developers with Python Backdoor
ReversingLabs discovers dbgpkg, a fake Python debugger that secretly backdoors systems to steal data. Researchers suspect a pro-Ukraine…...
CVE-2025-32295
CVE-2025-32295 corresponds to a Missing Authorization (broken access control) vulnerability in the WordPress plugin Salon Booking Pro (WordPress Salon Booking Pro) affecting version 10.10.2 and earlier. Multiple connected sources confirm an improper access-control configuration that could be expl...
CVE-2025-32295 WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through = 10.10.2...
CVE-2025-32296
CVE-2025-32296 affects WordPress plugin Simple Link Directory Pro
CVE-2025-32296 WordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control Vulnerability
Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through 14.8.1...
CVE-2025-32301 WordPress CountDown Pro WP Plugin <= 2.7 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup CountDown Pro WP Plugin circularcountdown allows SQL Injection.This issue affects CountDown Pro WP Plugin: from n/a through = 2.7...
CVE-2025-32301
CVE-2025-32301 : LambertGroup CountDown Pro WP Plugin (<= 2.7) has an SQL Injection vulnerability due to improper neutralization of input in SQL commands. The CVSS v3.1 score is 8.5 (HIGH) with NETWORK attack vector, LOW attack complexity, PRIVILEGES REQUIRED: LOW, and the impact on confidenti...
CVE-2025-32301 WordPress CountDown Pro WP Plugin <= 2.7 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup CountDown Pro WP Plugin allows SQL Injection. This issue affects CountDown Pro WP Plugin: from n/a through 2.7...
CVE-2025-46464
CVE-2025-46464 : Stored XSS in WordPress Ads Pro Plugin (scripteo Ads Pro). Triggered by improper input neutralization during web page generation. Affected: Ads Pro Plugin versions n/a–4.88. Connected sources indicate the flaw is present and unpatched in many disclosures; PatchSTACK lists a fix i...
CVE-2025-46464 WordPress Ads Pro plugin <= 4.88 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in scripteo Ads Pro Plugin allows Stored XSS. This issue affects Ads Pro Plugin: from n/a through 4.88...